CVE-2021-24427: vulnerability in BoldGrid W3 Total Cache
W3 Total Cache < 2.1.3 - Authenticated Stored XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.6%
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue
Affected products
BoldGrid · W3 Total CacheRelated CVEs — BoldGrid W3 Total Cache
In the same product, most dangerous first.
CVE-2021-24452—W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)EPSS 1.9%CVE-2021-24436—W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)EPSS 1.8%CVE-2026-57623CRITICALWordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerabilityEPSS 0.5%CVE-2026-66695MEDIUMWordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerabilityEPSS 0.4%CVE-2026-27384CRITICALWordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityEPSS 0.4%CVE-2026-39595MEDIUMWordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerabilityEPSS 0.2%